PT-2022-20638 · WordPress · Frontend File Manager Plugin

Raad Haddad · Published 2022-10-03 · Updated 2022-10-04 · CVE-2022-3125

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frontend File Manager Plugin WordPress plugin versions prior to 21.3

Description The issue allows any authenticated users to rename a file to an arbitrary extension, such as PHP, which could enable them to upload arbitrary files on the server and achieve remote code execution.

Recommendations For versions prior to 21.3, update to version 21.3 or later to resolve the issue.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-3125

Affected Products

Frontend File Manager Plugin

References · 6

• 🔥 https://wpscan.com/vulnerability/d3d9dc9a-226b-4f76-995e-e2af1dd6b17e · Exploit
• https://cve.org/CVERecord?id=CVE-2022-3125 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3125 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3125 · Security Note
• https://ubuntu.com/security/CVE-2022-3125 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3125 · Vendor Advisory